# Gorbag

> As of 2026-11-04, Gorbag is a Russia-nexus threat actor tracked by Threadlinqs Intelligence across 2 threats spanning apt. ATT&CK coverage spans 26 techniques across 9 tactics in 2 of 2 tracked threats. Most-observed techniques: T1005 (Data from Local System), T1059.001 (PowerShell), T1059.005 (Visual Basic).

- **Nation:** Russia
- **Tracked threats:** 2
- **Categories:** APT
- **As of:** 2026-11-04

## ATT&CK techniques observed

26 techniques observed across 2 of 2 tracked threats. Tactics: Resource Development (6), Stealth (formerly Defense Evasion) (5), Collection (4), Execution (4), Credential Access (3), Command and Control (1).

- [T1005](https://intel.threadlinqs.com/technique/T1005) Data from Local System — Collection — observed in 2 of 2 tracked threats
- [T1059.001](https://intel.threadlinqs.com/technique/T1059.001) PowerShell — Execution — observed in 2 of 2 tracked threats
- [T1059.005](https://intel.threadlinqs.com/technique/T1059.005) Visual Basic — Execution — observed in 2 of 2 tracked threats
- [T1070.004](https://intel.threadlinqs.com/technique/T1070.004) File Deletion — Stealth (formerly Defense Evasion) — observed in 2 of 2 tracked threats
- [T1203](https://intel.threadlinqs.com/technique/T1203) Exploitation for Client Execution — Execution — observed in 2 of 2 tracked threats
- [T1204.002](https://intel.threadlinqs.com/technique/T1204.002) Malicious File — Execution — observed in 2 of 2 tracked threats
- [T1547.001](https://intel.threadlinqs.com/technique/T1547.001) Boot or Logon Autostart Execution — Persistence — observed in 2 of 2 tracked threats
- [T1555.003](https://intel.threadlinqs.com/technique/T1555.003) Credentials from Web Browsers — Credential Access — observed in 2 of 2 tracked threats
- [T1566.001](https://intel.threadlinqs.com/technique/T1566.001) Spearphishing Attachment — Initial Access — observed in 2 of 2 tracked threats
- [T1586.002](https://intel.threadlinqs.com/technique/T1586.002) Email Accounts — Resource Development — observed in 2 of 2 tracked threats
- [T1025](https://intel.threadlinqs.com/technique/T1025) Data from Removable Media — Collection — observed in 1 of 2 tracked threats
- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1027.009](https://intel.threadlinqs.com/technique/T1027.009) Obfuscated Files or Information: Embedded Payloads — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1039](https://intel.threadlinqs.com/technique/T1039) Data from Network Shared Drive — Collection — observed in 1 of 2 tracked threats
- [T1071.001](https://intel.threadlinqs.com/technique/T1071.001) Application Layer Protocol — Command and Control — observed in 1 of 2 tracked threats

## Tracked threats

- [Gorbag: Russia-aligned espionage group targets Ukrainian war crimes investigations and military aid routes (BeautyStealer, Prime ReverseShell, CVE-2025-8088)](https://intel.threadlinqs.com/threat/TL-2026-5198) — HIGH
- [Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware (BeautyStealer, Prime ReverseShell) and CVE-2025-8088 WinRAR lures](https://intel.threadlinqs.com/threat/TL-2026-5141) — HIGH

## Related CVEs

1 CVE referenced by tracked Gorbag activity.

- [CVE-2025-8088](https://intel.threadlinqs.com/cve/CVE-2025-8088)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); the Threadlinqs MCP server (Purple) serves them to AI agents: https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/Gorbag